[ CVE-2026-6831 · Published 23 Sep 2026 ]
Vulnerability in vsourz1td Advanced Contact form 7 DB
CVSS 6.5
EPSS <1%No fix listed yet
[ Description ]Official description
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the 'acf7db' shortcode.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.